A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-29 03:01:39 -04:00
Code Issues Projects Releases Packages Wiki Activity

HID: core: Fix size as type u32

Browse source 
When size is negative, calling memset will make segment fault.
Declare the size as type u32 to keep memset safe.

size in struct hid_report is unsigned, fix return type of
hid_report_len to u32.

Cc: [email protected]
Signed-off-by: Aaron Ma <[email protected]>
Signed-off-by: Jiri Kosina <[email protected]>
This commit is contained in:
Aaron Ma 2018-01-08 10:41:41 +08:00 • committed by Jiri Kosina
commit 6de0b13cc0
2 changed files with 8 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

10
drivers/hid/hid-core.c
View file

@ -1365,7 +1365,7 @@ u8 *hid_alloc_report_buf(struct hid_report *report, gfp_t flags)
* of implement() working on 8 byte chunks
*/
int len = hid_report_len(report) + 7;
u32 len = hid_report_len(report) + 7;
return kmalloc(len, flags);
}
@ -1430,7 +1430,7 @@ void __hid_request(struct hid_device *hid, struct hid_report *report,
{
char *buf;
int ret;
int len;
u32 len;
buf = hid_alloc_report_buf(report, GFP_KERNEL);
if (!buf)
@ -1456,14 +1456,14 @@ out:
}
EXPORT_SYMBOL_GPL(__hid_request);
int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, int size,
int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size,
int interrupt)
{
struct hid_report_enum *report_enum = hid->report_enum + type;
struct hid_report *report;
struct hid_driver *hdrv;
unsigned int a;
int rsize, csize = size;
u32 rsize, csize = size;
u8 *cdata = data;
int ret = 0;
@ -1521,7 +1521,7 @@ EXPORT_SYMBOL_GPL(hid_report_raw_event);
*
* This is data entry for lower layers.
*/
int hid_input_report(struct hid_device *hid, int type, u8 *data, int size, int interrupt)
int hid_input_report(struct hid_device *hid, int type, u8 *data, u32 size, int interrupt)
{
struct hid_report_enum *report_enum;
struct hid_driver *hdrv;